chore: extend license and english-only gates to kt, py and css (#1407)

The license gate listed only go/sh/js/mjs/ts/tsx, so eight Python and six
CSS source files carried no SPDX header while still passing CI. Backfill
those headers, and cover kt/kts before any Kotlin code lands.

AGENTS.md

@@ -30,8 +30,9 @@ open-code-review (`ocr`) is an AI-powered code review CLI tool written in Go (mo
 
 ## License Headers
 
-- Every source file (`.go`, `.sh`, `.js`, `.mjs`, `.ts`, `.tsx`) must have an SPDX license header.
-- After creating new files, run `make license-add` to add the header automatically.
+- Every source file (`.go`, `.js`, `.mjs`, `.ts`, `.tsx`, `.kt`, `.kts`, `.sh`, `.py`, `.css`) must have an SPDX license header.
+- After creating new files, run `make license-add` to add the header automatically. It picks the comment syntax by extension: `//`, `#`, or a `/* */` block for CSS.
+- An extension belongs on that list once the repository actually holds files of that type and the comment can simply be prepended. `.html` meets neither bar cleanly — its `<!DOCTYPE html>` has to stay on the first line — so it is not covered yet.
 
 ## Code Style
 

CONTRIBUTING.md

@@ -102,7 +102,7 @@ docs(README): update configuration examples
 
 ### License Headers
 
-Every source file (`.go`, `.sh`, `.js`, `.mjs`, `.ts`, `.tsx`) must include an SPDX license header. After creating new files, run:
+Every source file (`.go`, `.js`, `.mjs`, `.ts`, `.tsx`, `.kt`, `.kts`, `.sh`, `.py`, `.css`) must include an SPDX license header. After creating new files, run:
 
 ```bash
 make license-add

docs/i18n/CONTRIBUTING.ja-JP.md

@@ -92,7 +92,7 @@ docs(README): update configuration examples
 
 ### ライセンスヘッダー
 
-すべてのソースファイル（`.go`、`.sh`、`.js`、`.mjs`、`.ts`、`.tsx`）にはSPDXライセンスヘッダーが必要です。新しいファイルを作成した後、以下を実行してください：
+すべてのソースファイル（`.go`、`.js`、`.mjs`、`.ts`、`.tsx`、`.kt`、`.kts`、`.sh`、`.py`、`.css`）にはSPDXライセンスヘッダーが必要です。新しいファイルを作成した後、以下を実行してください：
 
 ```bash
 make license-add

docs/i18n/CONTRIBUTING.ko-KR.md

@@ -92,7 +92,7 @@ docs(README): update configuration examples
 
 ### License Headers
 
-모든 소스 파일(`.go`, `.sh`, `.js`, `.mjs`, `.ts`, `.tsx`)에는 SPDX 라이선스 헤더가 필요합니다. 새 파일을 생성한 후 다음을 실행하세요:
+모든 소스 파일(`.go`, `.js`, `.mjs`, `.ts`, `.tsx`, `.kt`, `.kts`, `.sh`, `.py`, `.css`)에는 SPDX 라이선스 헤더가 필요합니다. 새 파일을 생성한 후 다음을 실행하세요:
 
 ```bash
 make license-add

docs/i18n/CONTRIBUTING.ru-RU.md

@@ -92,7 +92,7 @@ docs(README): update configuration examples
 
 ### Заголовки лицензии
 
-Каждый исходный файл (`.go`, `.sh`, `.js`, `.mjs`, `.ts`, `.tsx`) должен содержать заголовок лицензии SPDX. После создания новых файлов выполните:
+Каждый исходный файл (`.go`, `.js`, `.mjs`, `.ts`, `.tsx`, `.kt`, `.kts`, `.sh`, `.py`, `.css`) должен содержать заголовок лицензии SPDX. После создания новых файлов выполните:
 
 ```bash
 make license-add

docs/i18n/CONTRIBUTING.zh-CN.md

@@ -92,7 +92,7 @@ docs(README): update configuration examples
 
 ### 许可证头
 
-每个源文件（`.go`、`.sh`、`.js`、`.mjs`、`.ts`、`.tsx`）都必须包含 SPDX 许可证头。创建新文件后请运行：
+每个源文件（`.go`、`.js`、`.mjs`、`.ts`、`.tsx`、`.kt`、`.kts`、`.sh`、`.py`、`.css`）都必须包含 SPDX 许可证头。创建新文件后请运行：
 
 ```bash
 make license-add

examples/codeup_ci/post_review.py

@@ -1,4 +1,8 @@
 #!/usr/bin/env python3
+
+# SPDX-License-Identifier: Apache-2.0
+# Copyright 2026 alibaba/open-code-review Contributors
+
 """post_review.py
 
 Runs Open Code Review (`ocr review --format json`) against the current

examples/codeup_ci/post_review_test.py

@@ -1,4 +1,8 @@
 #!/usr/bin/env python3
+
+# SPDX-License-Identifier: Apache-2.0
+# Copyright 2026 alibaba/open-code-review Contributors
+
 """Unit tests for post_review.py.
 
 Run with:

examples/gerrit_ci/post_review.py

@@ -1,4 +1,8 @@
 #!/usr/bin/env python3
+
+# SPDX-License-Identifier: Apache-2.0
+# Copyright 2026 alibaba/open-code-review Contributors
+
 """Post an OpenCodeReview result onto a Gerrit change.
 
 This is the CI-layer "glue" for Gerrit, mirroring examples/gitflic_ci: it keeps

examples/gerrit_ci/post_review_test.py

@@ -1,4 +1,8 @@
 #!/usr/bin/env python3
+
+# SPDX-License-Identifier: Apache-2.0
+# Copyright 2026 alibaba/open-code-review Contributors
+
 """Tests for post_review.py.
 
 Standard-library unittest only (no pytest, no network, no live Gerrit): run with

examples/gitflic_ci/post_review.py

@@ -1,4 +1,8 @@
 #!/usr/bin/env python3
+
+# SPDX-License-Identifier: Apache-2.0
+# Copyright 2026 alibaba/open-code-review Contributors
+
 """Post an OpenCodeReview result onto a GitFlic merge request.
 
 This is the CI-layer "glue" for GitFlic, mirroring examples/gitlab_ci: it keeps

examples/gitflic_ci/post_review_test.py

@@ -1,4 +1,8 @@
 #!/usr/bin/env python3
+
+# SPDX-License-Identifier: Apache-2.0
+# Copyright 2026 alibaba/open-code-review Contributors
+
 """Tests for post_review.py.
 
 Standard-library unittest only (no pytest, no network, no git): run with

examples/gitlab_ci/post_review.py

@@ -1,4 +1,8 @@
 #!/usr/bin/env python3
+
+# SPDX-License-Identifier: Apache-2.0
+# Copyright 2026 alibaba/open-code-review Contributors
+
 """Post an OpenCodeReview result onto a GitLab merge request.
 
 This is the CI-layer "glue" for GitLab, mirroring examples/gerrit_ci and

examples/gitlab_ci/post_review_test.py

@@ -1,4 +1,8 @@
 #!/usr/bin/env python3
+
+# SPDX-License-Identifier: Apache-2.0
+# Copyright 2026 alibaba/open-code-review Contributors
+
 """Tests for post_review.py.
 
 Standard-library unittest only (no pytest, no network, no real time.sleep): run with

extensions/vscode/src/webview/styles/global.css

@@ -1,3 +1,8 @@
+/*
+SPDX-License-Identifier: Apache-2.0
+Copyright 2026 alibaba/open-code-review Contributors
+*/
+
 /* === 1. CSS Variables ===
  * 结构色映射到 VSCode 主题 token(带 silent-night 回退值),自动适配亮/暗主题。
  * accent(薄荷绿)保留为品牌色,不跟随主题。 */

internal/viewer/static/style.css

@@ -1,3 +1,8 @@
+/*
+SPDX-License-Identifier: Apache-2.0
+Copyright 2026 alibaba/open-code-review Contributors
+*/
+
 
 :root {
     color-scheme: light dark;

pages/src/components/ColorBends.css

@@ -1,3 +1,8 @@
+/*
+SPDX-License-Identifier: Apache-2.0
+Copyright 2026 alibaba/open-code-review Contributors
+*/
+
 .color-bends-container {
   width: 100%;
   height: 100%;

pages/src/content/docs/en/contributing.md

@@ -169,7 +169,7 @@ Thanks!
 
 ## License headers
 
-Every source file (`.go`, `.sh`, `.js`, `.mjs`, `.ts`, `.tsx`) must include an SPDX license header. After creating new files, run:
+Every source file (`.go`, `.js`, `.mjs`, `.ts`, `.tsx`, `.kt`, `.kts`, `.sh`, `.py`, `.css`) must include an SPDX license header. After creating new files, run:
 
 ```bash
 make license-add

pages/src/content/docs/ja/contributing.md

@@ -164,7 +164,7 @@ AI を開発に使った場合は、下記のルールに従ってください
 
 ## ライセンスヘッダー
 
-すべてのソースファイル（`.go`、`.sh`、`.js`、`.mjs`、`.ts`、`.tsx`）にはSPDXライセンスヘッダーが必要です。新しいファイルを作成した後、以下を実行してください：
+すべてのソースファイル（`.go`、`.js`、`.mjs`、`.ts`、`.tsx`、`.kt`、`.kts`、`.sh`、`.py`、`.css`）にはSPDXライセンスヘッダーが必要です。新しいファイルを作成した後、以下を実行してください：
 
 ```bash
 make license-add

pages/src/content/docs/ko/contributing.md

@@ -169,8 +169,8 @@ AI가 개발 과정에 관여했다면 아래 규칙을 따라 주세요.
 
 ## 라이선스 헤더 {#license-headers}
 
-모든 소스 파일(`.go`, `.sh`, `.js`, `.mjs`, `.ts`, `.tsx`)에는 SPDX 라이선스
-헤더가 있어야 합니다. 파일을 새로 만들었다면 다음을 실행하세요.
+모든 소스 파일(`.go`, `.js`, `.mjs`, `.ts`, `.tsx`, `.kt`, `.kts`, `.sh`, `.py`,
+`.css`)에는 SPDX 라이선스 헤더가 있어야 합니다. 파일을 새로 만들었다면 다음을 실행하세요.
 
 ```bash
 make license-add

pages/src/content/docs/ru/contributing.md

@@ -170,7 +170,7 @@ open-code-review/
 
 ## Заголовки лицензии
 
-Каждый исходный файл (`.go`, `.sh`, `.js`, `.mjs`, `.ts`, `.tsx`) должен содержать заголовок лицензии SPDX. После создания новых файлов выполните:
+Каждый исходный файл (`.go`, `.js`, `.mjs`, `.ts`, `.tsx`, `.kt`, `.kts`, `.sh`, `.py`, `.css`) должен содержать заголовок лицензии SPDX. После создания новых файлов выполните:
 
 ```bash
 make license-add

pages/src/content/docs/zh/contributing.md

@@ -163,7 +163,7 @@ open-code-review/
 
 ## 许可证头
 
-每个源文件（`.go`、`.sh`、`.js`、`.mjs`、`.ts`、`.tsx`）都必须包含 SPDX 许可证头。创建新文件后请运行：
+每个源文件（`.go`、`.js`、`.mjs`、`.ts`、`.tsx`、`.kt`、`.kts`、`.sh`、`.py`、`.css`）都必须包含 SPDX 许可证头。创建新文件后请运行：
 
 ```bash
 make license-add

pages/src/styles/blog.css

@@ -1,3 +1,8 @@
+/*
+SPDX-License-Identifier: Apache-2.0
+Copyright 2026 alibaba/open-code-review Contributors
+*/
+
 /* Blog-specific styles */
 
 .blog-card {

pages/src/styles/docs-markdown.css

@@ -1,3 +1,8 @@
+/*
+SPDX-License-Identifier: Apache-2.0
+Copyright 2026 alibaba/open-code-review Contributors
+*/
+
 /* Docs Markdown dark theme styles — matching DocsPage design */
 .docs-markdown {
   font-family: -apple-system, BlinkMacSystemFont, 'PingFang SC', 'Segoe UI', Roboto, sans-serif;

pages/src/styles/index.css

@@ -1,3 +1,8 @@
+/*
+SPDX-License-Identifier: Apache-2.0
+Copyright 2026 alibaba/open-code-review Contributors
+*/
+
 @tailwind base;
 @tailwind components;
 @tailwind utilities;

scripts/add-license.sh

@@ -18,7 +18,19 @@ SLASH_HEADER='// SPDX-License-Identifier: Apache-2.0
 HASH_HEADER='# SPDX-License-Identifier: Apache-2.0
 # Copyright 2026 alibaba/open-code-review Contributors'
 
-LICENSE_EXTS=(go sh js mjs ts tsx)
+# CSS has no // line comment — that is SCSS — so a block is the only option. The
+# lines inside carry no prefix, matching the {{/* */}} header already in
+# internal/viewer/templates/app-header.html.
+BLOCK_HEADER='/*
+SPDX-License-Identifier: Apache-2.0
+Copyright 2026 alibaba/open-code-review Contributors
+*/'
+
+# Grouped by the comment syntax add_header gives each below: // for Go, the
+# JS/TS family and Kotlin, # for shell and Python, /* */ for CSS. Extensions
+# whose comment cannot simply be prepended stay out — .html would need its
+# DOCTYPE kept on the first line, so it is not covered yet.
+LICENSE_EXTS=(go js mjs ts tsx kt kts sh py css)
 
 IGNORED_PATHS=(
   "vendor/"
@@ -100,8 +112,9 @@ while IFS= read -r file; do
   has_header "$file" && continue
 
   case "$ext" in
-    sh) add_header "$file" "$HASH_HEADER" ;;
-    *)  add_header "$file" "$SLASH_HEADER" ;;
+    sh | py) add_header "$file" "$HASH_HEADER" ;;
+    css) add_header "$file" "$BLOCK_HEADER" ;;
+    *) add_header "$file" "$SLASH_HEADER" ;;
   esac
 
   ADDED=$((ADDED + 1))

scripts/verify-english-only.go

@@ -61,9 +61,10 @@ import (
 
 // scannedExts lists the extensions treated as source files.
 var scannedExts = map[string]bool{
-	".go": true, ".ts": true, ".tsx": true, ".js": true, ".cjs": true,
-	".mjs": true, ".py": true, ".sh": true, ".ps1": true, ".css": true,
-	".html": true, ".yml": true, ".yaml": true, ".json": true,
+	".go": true, ".kt": true, ".kts": true, ".ts": true, ".tsx": true,
+	".js": true, ".cjs": true, ".mjs": true, ".py": true, ".sh": true,
+	".ps1": true, ".css": true, ".html": true, ".yml": true,
+	".yaml": true, ".json": true,
 }
 
 // scannedNames lists extension-less files that are still source files.

scripts/verify-license.sh

@@ -14,7 +14,10 @@ SPDX_REGEX="SPDX-License-Identifier: Apache-2.0"
 COPYRIGHT_REGEX="Copyright [0-9]{4} alibaba/open-code-review Contributors"
 YEAR_REGEX="Copyright ([0-9]{4})"
 
-LICENSE_EXTS=(go sh js mjs ts tsx)
+# Keep in step with LICENSE_EXTS in add-license.sh, which also records why each
+# extension is in or out. This side only greps for the header text, so the
+# comment syntax does not matter here.
+LICENSE_EXTS=(go js mjs ts tsx kt kts sh py css)
 
 IGNORED_PATHS=(
   "vendor/"